Secure remote subscription management

• US 9,681,296 B2
• Filed: 08/15/2014
• Issued: 06/13/2017
• Est. Priority Date: 03/05/2009
• Status: Expired due to Fees

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Inventors: Meyerstein, Michael V, Shah, Yogendra C., Cha, Inhyok, Leicher, Andreas, Schmidt, Andreas
• Primary Examiner(s): ZHAO, DON GORDON
• Application Number:
  US14/460,444
• Publication Number:
  US 20140359278A1
• Time in Patent Office: 1,033 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04W 12/043 using a trusted network node as an anchor
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 8/265 for initial activation of new user
• CPC Class Codes: H04W 88/18 Service support devices; Network management devices

Abstract

A method and apparatus are disclosed for performing secure remote subscription management. Secure remote subscription management may include providing the Wireless Transmit/Receive Unit (WTRU) with a connectivity identifier, such as a Provisional Connectivity Identifier (PCID), which may be used to establish an initial network connection to an Initial Connectivity Operator (ICO) for initial secure remote registration, provisioning, and activation. A connection to the ICO may be used to remotely provision the WTRU with credentials associated with the Selected Home Operator (SHO). A credential, such as a cryptographic keyset, which may be included in the Trusted Physical Unit (TPU), may be allocated to the SHO and may be activated. The WTRU may establish a network connection to the SHO and may receive services using the remotely managed credentials. Secure remote subscription management may be repeated to associate the WTRU with another SHO.

Claims

1. A method for use in wireless communication by a wireless transmit/receive unit (WTRU), the method comprising:

the WTRU establishing a connection to an initial connectivity operator (ICO) using a first keyset and an initial connectivity operator identifier;

the WTRU receiving, from the ICO, a first subscriber identifier associated with a selected home operator;

the WTRU generating, after receiving the first subscriber identifier from the ICO, a second keyset using a keyset generation protocol, wherein the second keyset is different from the first keyset;

the WTRU using the second keyset and the first subscriber identifier to establish a connection to the selected home operator; and

,

wherein the ICO is informed that the second keyset has been generated.

2. The method recited in claim 1, wherein the keyset generation protocol comprises a Public and Private Key establishment protocol.

3. The method recited in claim 2, wherein the Public and Private Key establishment protocol comprises a Public Key Cryptography Standards (PKCS) protocol.

4. The method recited in claim 2, wherein a public key of the second keyset is sent to the ICO for certification.

5. The method recited in claim 1, wherein the keyset generation protocol comprises a shared symmetric key generation protocol.

6. The method recited in claim 5, wherein the shared symmetric key generation protocol comprises a generic bootstrapping architecture (GBA) protocol.

7. The method recited in claim 5, wherein the shared symmetric key generation protocol comprises a European standard EN726 part 7 protocol.

8. A method for use in wireless communication by a wireless transmit/receive unit (WTRU), the method comprising:

the WTRU establishing a connection to an initial connectivity operator (ICO) using a first keyset and an initial connectivity operator identifier, the first keyset and the initial connectivity operator identifier being provisioned on the WTRU;

the WTRU receiving a first subscriber identifier from the ICO, the first subscriber identifier being associated with a first selected home operator;

the WTRU generating, after receiving the first subscriber identifier, a second keyset using a keyset generation protocol, wherein the second keyset is different from the first keyset;

the WTRU establishing a connection to the first selected home operator using the second keyset and the first subscriber identifier;

the WTRU thereafter receiving a second subscriber identifier, the second subscriber identifier being associated with a second selected home operator;

the WTRU generating, after receiving the second subscriber identifier, a third keyset different from the second keyset using the keyset generation protocol;

the WTRU establishing a connection to the second selected home operator using the second subscriber identifier and the third keyset; and

,

wherein the ICO is informed that the second keyset and the third keyset have been generated.

9. The method recited in claim 8, wherein the third keyset is also different from the first keyset associated with the initial connectivity operator.

10. The method recited in claim 8, wherein the keyset generation protocol comprises a Public and Private Key establishment protocol.

11. The method recited in claim 10, wherein the Public and Private Key establishment protocol comprises a Public Key Cryptography Standards (PKCS) protocol.

12. The method recited in claim 10, wherein a public key of the second keyset is sent to the ICO for certification.

13. The method recited in claim 8, wherein the keyset generation protocol comprises a shared symmetric key generation protocol.

14. The method recited in claim 13, wherein the shared symmetric key generation protocol comprises a generic bootstrapping architecture (GBA) protocol.

15. The method recited in claim 13, wherein the shared symmetric key generation protocol comprises a European standard EN726 part 7 protocol.

16. The method recited in claim 8, wherein the first subscriber identifier is received from the initial connectivity operator, and wherein the second subscriber identifier is received from the first selected home operator or the initial connectivity operator.

17. A wireless transmit/receive unit (WTRU) comprising a processor, a memory, and a transceiver, configured to:

establish a connection to an initial connectivity operator (ICO) using a first keyset and an initial connectivity operator identifier;

receive, from the ICO, a first subscriber identifier associated with a selected home operator;

generate, after receiving the first subscriber identifier from the ICO, a second keyset using a keyset generation protocol, wherein the second keyset is different from the first keyset;

use the second keyset and the first subscriber identifier to establish a connection to the selected home operator; and

,

wherein the ICO is informed that the second keyset has been generated.

18. The WTRU recited in claim 17, wherein the keyset generation protocol comprises a Public and Private Key establishment protocol.

19. The WTRU recited in claim 18, wherein the Public and Private Key establishment protocol comprises a Public Key Cryptography Standards (PKCS) protocol.

20. The WTRU recited in claim 18, wherein the WTRU is further configured to send a public key of the second keyset to the ICO for certification.

21. The WTRU recited in claim 17, wherein the keyset generation protocol comprises a shared symmetric key generation protocol.

22. The WTRU recited in claim 21, wherein the shared symmetric key generation protocol comprises a generic bootstrapping architecture (GBA) protocol.

23. The WTRU recited in claim 21, wherein the shared symmetric key generation protocol comprises a European standard EN726 part 7 protocol.

24. A wireless transmit/receive unit (WTRU) comprising a processor, a memory, and a transceiver, configured to:

establish a connection to an initial connectivity operator (ICO) using a first keyset and an initial connectivity operator identifier, the first keyset and the initial connectivity operator identifier being provisioned on the WTRU;

receive a first subscriber identifier from the ICO, the first subscriber identifier being associated with a first selected home operator;

generate, after receiving the first subscriber identifier, a second keyset using a keyset generation protocol, wherein the second keyset is different from the first keyset;

establish a connection to the first selected home operator using the second keyset and the first subscriber identifier;

thereafter receive a second subscriber identifier, the second subscriber identifier being associated with a second selected home operator;

generate, after receiving the second subscriber identifier, a third keyset different from the second keyset using the keyset generation protocol;

establish a connection to the second selected home operator using the second subscriber identifier and the third keyset; and

,

wherein the ICO is informed that the second keyset and the third keyset have been generated.

25. The WTRU recited in claim 24, wherein the third keyset is also different from the first keyset associated with the initial connectivity operator.

26. The WTRU recited in claim 24, wherein the first subscriber identifier is received from the initial connectivity operator, and wherein the second subscriber identifier is received from the first selected home operator or the initial connectivity operator.

27. The WTRU recited in claim 24, wherein the keyset generation protocol comprises a Public and Private Key establishment protocol.

28. The WTRU recited in claim 27, wherein the Public and Private Key establishment protocol comprises a Public Key Cryptography Standards (PKCS) protocol.

29. The WTRU recited in claim 27, wherein the WTRU is further configured to send a public key of the second keyset to the ICO for certification.

30. The WTRU recited in claim 24, wherein the keyset generation protocol comprises a shared symmetric key generation protocol.

31. The WTRU recited in claim 30, wherein the shared symmetric key generation protocol comprises a generic bootstrapping architecture (GBA) protocol.

32. The WTRU recited in claim 30, wherein the shared symmetric key generation protocol comprises a European standard EN726 part 7 protocol.